Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access

1. Executive summary

Mandiant has published detailed attack-chain analysis of CVE-2026-20245 (CVSS 7.8 HIGH, CWE-116), a now-patched privilege-escalation zero-day in Cisco Catalyst SD-WAN Manager (vManage), Controller (vSmart), and Validator (vBond). The vulnerability is listed in CISA KEV (added 2026-06-09) with an EPSS of 10%. Mandiant attributes the activity to an unconfirmed threat actor targeting a communications service provider beginning in March 2026 — earlier than Cisco's June disclosure — using rogue SD-WAN peering to establish initial access, then exploiting CVE-2026-20245 to escalate from a compromised administrative account to full root. For EMEA financial services running Cisco Catalyst SD-WAN, the bottom-line risk is total visibility into corporate internet traffic and persistent network-layer access, which is particularly acute for institutions relying on SD-WAN for site-to-data-centre connectivity.

2. Regulatory framing

3. Technical analysis & attack chain

Affected products: Cisco Catalyst SD-WAN Manager (vManage), Controller (vSmart), and Validator (vBond). All versions affected regardless of device configuration and across all deployment types (on-premises, cloud-based, FedRAMP-certified).

Vulnerability mechanism: CVE-2026-20245 (CVSS 7.8 HIGH, CWE-116 — improper buffer size validation / memory boundary condition) is an authenticated, local command injection in the SD-WAN CLI. The flaw stems from insufficient validation of user-supplied input. An attacker with netadmin privileges can upload a specially crafted file to the vulnerable system, causing arbitrary command execution as root. Cisco states no workarounds are available; patching is the only remediation.

Prerequisite access: Exploitation requires netadmin privileges on the affected system. This can be obtained via valid credentials or through exploitation of CVE-2026-20182 or CVE-2026-20127 (both previously disclosed SD-WAN authentication-bypass zero-days). Cisco states it is not aware of successful exploitation by other methods.

Confirmed attack chain (Mandiant, single-sourced — verify before enforcement)

1. Initial access via rogue peering (March 2026): The threat actor established unauthorised SD-WAN peering connections on a communications service provider's infrastructure. The rogue peering abused the SD-WAN fabric to authenticate between network components and facilitate SSH access. Mandiant believes the rogue peering may have been created by exploiting CVE-2026-20127 and CVE-2026-20182, though the exact method remains unclear. Notably, some rogue peering activity in March 2026 occurred on systems not vulnerable to either previously disclosed authentication-bypass flaw. Cisco told Mandiant the breach did not involve CVE-2026-20182 and suggested attackers may have used certificates stolen during a previous compromise to regain access.
2. SSH authentication: The attacker authenticated to the SD-WAN Manager device via SSH using the vmanage-admin account on the same victim devices. Neither the vmanage-admin nor the admin accounts on Cisco Catalyst SD-WAN controllers possess root shell access.
3. Credential manipulation: The attacker changed the default password on the admin account, then authenticated directly to the SD-WAN Manager web application interface using the admin account.
4. Configuration exfiltration: The attacker exfiltrated SD-WAN fabric configurations, including configuration information for edge devices, controllers, and SD-WAN templates.
5. Credential restoration (anti-forensics): The attacker changed the admin account password back to its original value before terminating the active session, likely to reduce detection.
6. Privilege escalation via CVE-2026-20245: The attacker exploited CVE-2026-20245 through a tenant-upload feature in the SD-WAN CLI by uploading a malicious CSV file named evil_tenant.csv. The file contained the exploit payload.
7. Root account creation: Upon execution, the payload first created backups of system configuration files, including /etc/passwd and /etc/shadow. It then created a new user account named troot with full root-level privileges.
8. Privilege switching: The attacker used the Linux su command to switch from the compromised administrative account to the newly created troot root account, gaining full control over the device.
9. Anti-forensic cleanup: The attacker backed up configuration files before modifying them and restored them after exploitation. They deleted the malicious CSV payload (evil_tenant.csv), removed temporary files created during the attack, and erased evidence of the rogue root account. A validation script was executed to confirm that all traces of the compromise had been removed from the device.

Observed impact: Mandiant states it cannot assess the full scope of the intruders' post-compromise activity but notes the compromise could have given the attacker total visibility across an entire corporation's internet traffic. Mandiant also notes SD-WAN zero-days are high-value targets for government-sponsored espionage actors seeking long-term network snooping capabilities.

Attribution: No named threat actor is identified. No MITRE ATT&CK profile is available for the actor. Attribution is unconfirmed. The activity is single-sourced to Mandiant's incident response report.

Discrepancy note: The BleepingComputer source describes CVE-2026-20245 as a "command injection flaw," while the verified reference data classifies it as CWE-116 (improper buffer size validation / memory boundary condition). Both classifications can describe the same underlying flaw — a memory boundary condition in input validation that enables command injection. The verified CVSS 7.8 HIGH and CWE-116 classification are authoritative.

4. Mitigation & containment

P1 — Within 24 hours

• Identify exposed assets: Inventory all Cisco Catalyst SD-WAN Manager, Controller (vSmart), and Validator (vBond) instances across all deployment types (on-premises, cloud, FedRAMP). Confirm versions.
• Restrict management-plane access: Immediately restrict SSH and web interface access to SD-WAN management interfaces to known administrative source IPs only. Enforce ACLs at network boundaries.
• Audit credential state: Check for unauthorised changes to vmanage-admin and admin account passwords. Verify password integrity against known-good values. Rotate both accounts' credentials if any discrepancy is found.
• Hunt for rogue peering: Review SD-WAN peering tables for unauthorised peer connections. Any unexpected peer entry is a high-confidence indicator of compromise.

P2 — Within 72 hours

• Patch to fixed release: Cisco has released security updates for CVE-2026-20245. Upgrade all Cisco Catalyst SD-WAN Manager, Controller, and Validator instances to the fixed software version. Cisco states no workarounds are available — patching is mandatory.
• Hunt for troot account: Search all SD-WAN Linux environments for the presence of a user account named troot. Check /etc/passwd and /etc/shadow for this account. If found, treat the device as compromised and isolate.
• Hunt for evil_tenant.csv: Search filesystems for any file named evil_tenant.csv or residual temporary files associated with the tenant-upload exploit path. If found, preserve for forensic analysis and isolate the device.
• Audit SSH sessions: Review SSH logs on all SD-WAN Manager devices for sessions authenticated as vmanage-admin from unexpected source IPs.
• Review configuration exports: Audit for unauthorised configuration exports or exfiltration of SD-WAN fabric configurations, edge device configurations, controller configurations, and template data.

P3 — Within 7 days

• Certificate rotation: Given Cisco's suggestion that stolen certificates may have been used to establish rogue peering, rotate all SD-WAN certificates across the estate. Re-enroll all SD-WAN components with new certificates.
• Patch prerequisite CVEs: Ensure CVE-2026-20182 and CVE-2026-20127 are patched on all SD-WAN components, as these are the documented paths to obtaining the netadmin access required for CVE-2026-20245 exploitation. Cisco recommends upgrading to the fixed software released in May 2026 for CVE-2026-20182 as a protective measure.
• Validate anti-forensic artefacts: Run integrity checks on /etc/passwd and /etc/shadow across all SD-WAN devices. Look for evidence of backup-and-restore cycles (e.g., /etc/passwd.bak, /etc/shadow.bak or similar) that would indicate the anti-forensic pattern described by Mandiant.
• Network segmentation review: Review whether SD-WAN management interfaces are segmented from general corporate network space. Tighten segmentation to limit lateral movement to the management plane.

5. Indicators of compromise

filename  evil_tenant.csv
username  troot
account  vmanage-admin
account  admin
filepath  /etc/passwd
filepath  /etc/shadow
command  su
behaviour  rogue_sd_wan_peering

6. Detection

rule Cisco_SDWAN_CVE_2026_20245_Exploit_Artefacts {
    meta {
        author = "Adverse Trace"
        date = "2026-06-25"
        reference = "https://www.bleepingcomputer.com/news/security/mandiant-reveals-how-cisco-sd-wan-zero-day-attacks-gained-root-access/"
        description = "Detects artefacts associated with CVE-2026-20245 exploitation as described by Mandiant: malicious CSV payload, rogue root account creation, and anti-forensic file operations."
    }
    strings:
        $csv_filename = "evil_tenant.csv" nocase
        $troot_user = "troot" nocase
        $vmanage_admin = "vmanage-admin" nocase
        $passwd_path = "/etc/passwd" nocase
        $shadow_path = "/etc/shadow" nocase
        $su_command = "su" nocase
    condition:
        3 of them
}

title: Detect Rogue Root Account Creation on Cisco SD-WAN Devices
id: ad-trace-2026-06-25-171-1
status: experimental
description: Detects creation of the 'troot' user account on Cisco SD-WAN Linux environments, consistent with CVE-2026-20245 exploitation as described by Mandiant.
author: Adverse Trace
date: 2026/06/25
references:

  - https://www.bleepingcomputer.com/news/security/mandiant-reveals-how-cisco-sd-wan-zero-day-attacks-gained-root-access/
logsource:
    product: linux
    service: auth
detection:
    selection:

        - User: "troot"
        - CommandLine|contains:
            - "useradd troot"
            - "adduser troot"
    condition: selection
falsepositives:

    - Legitimate administrative account creation with the name 'troot' (unlikely)
level: high

title: Detect SSH Access to Cisco SD-WAN Manager via vmanage-admin Account
id: ad-trace-2026-06-25-171-2
status: experimental
description: Detects SSH authentication to SD-WAN Manager devices using the vmanage-admin account, which was observed in Mandiant's analysis of CVE-2026-20245 exploitation.
author: Adverse Trace
date: 2026/06/25
references:

  - https://www.bleepingcomputer.com/news/security/mandiant-reveals-how-cisco-sd-wan-zero-day-attacks-gained-root-access/
logsource:
    product: linux
    service: sshd
detection:
    selection:
        User: "vmanage-admin"
        EventType: "ssh_auth"
    filter:
        SourceIp|cidr:

            - "10.0.0.0/8"
            - "192.168.0.0/16"
    condition: selection and not filter
falsepositives:

    - Legitimate administrator SSH access using vmanage-admin from non-RFC1918 addresses
level: medium

title: Detect evil_tenant.csv File Upload on Cisco SD-WAN CLI
id: ad-trace-2026-06-25-171-3
status: experimental
description: Detects the upload or presence of evil_tenant.csv on Cisco SD-WAN devices, consistent with the CVE-2026-20245 exploit payload described by Mandiant.
author: Adverse Trace
date: 2026/06/25
references:

  - https://www.bleepingcomputer.com/news/security/mandiant-reveals-how-cisco-sd-wan-zero-day-attacks-gained-root-access/
logsource:
    product: linux
    service: file_event
detection:
    selection:
        TargetFilename|contains: "evil_tenant.csv"
    condition: selection
falsepositives:

    - None expected
level: critical

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

7. Sources

• BleepingComputer — "Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access" — https://www.bleepingcomputer.com/news/security/mandiant-reveals-how-cisco-sd-wan-zero-day-attacks-gained-root-access/ — 2026-06-24
• BleepingComputer — "Cisco fixes SD-WAN vManage flaw exploited in zero-day attacks" — https://www.bleepingcomputer.com/news/security/cisco-fixes-sd-wan-vmanage-flaw-exploited-in-zero-day-attacks/ — 2026
• BleepingComputer — "Cisco warns of unpatched SD-WAN zero-day exploited in attacks" — https://www.bleepingcomputer.com/news/security/new-cisco-sd-wan-flaw-exploited-in-zero-day-attacks-to-gain-root/ — 2026
• The Register Security — "Yet another Cisco SD-WAN 0-day under attack, and no patch in sight" — https://www.theregister.com/security/2026/06/05/yet-another-cisco-sd-wan-0-day-under-attack-and-no-patch-in-sight/5251855 — 2026-06-05
• Help Net Security — "Cisco SD-WAN 0-day exploited, no patch available (CVE-2026-20245)" — https://www.helpnetsecurity.com/2026/06/05/cisco-sd-wan-cve-2026-20245-0-day-exploited/ — 2026-06-05
• SecurityWeek — "Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks" — https://www.securityweek.com/cisco-patches-another-sd-wan-zero-day-exploited-in-attacks/ — 2026
• The Register Security — "The hits keep on coming for Cisco vulnerabilities" — https://www.theregister.com/security/2026/06/24/the-hits-keep-on-coming-for-cisco-vulnerabilities/5261797 — 2026-06-24

8. Adverse Trace position

CVE-2026-20245 is a CVSS 7.8 HIGH vulnerability, CISA KEV-listed (added 2026-06-09), with confirmed active exploitation and a detailed Mandiant attack chain demonstrating full root-level device compromise. The EPSS of 10% is low relative to the severity, but this reflects probabilistic exploitation across the install base — for organisations running Cisco Catalyst SD-WAN, the risk is materially higher. The attack chain is single-sourced to Mandiant's incident response findings; attribution is unconfirmed and no named actor has a MITRE profile. EMEA financial services clients should treat this as a priority patch-and-hunt action: patch all SD-WAN components to the fixed release, hunt for the troot account and evil_tenant.csv artefacts across the estate, audit for rogue peering connections, and rotate SD-WAN certificates given Cisco's suggestion that stolen certificates may have been used for initial access. Adverse Trace will continue to monitor for additional Mandiant findings, any confirmed attribution, and any related CVE-2026-20262 activity (the related Catalyst SD-WAN Manager zero-day involving arbitrary file write) and will issue updates if the scope of exploitation expands.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.